@webpieces/core-context 0.4.641 → 0.4.643

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/core-context",
-  "version": "0.4.641",
+  "version": "0.4.643",
   "description": "AsyncLocalStorage-based context management for request-scoped data",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,7 +22,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-util": "0.4.641",
+    "@webpieces/core-util": "0.4.643",
     "@inversifyjs/binding-decorators": "1.1.5",
     "inversify": "7.10.4",
     "reflect-metadata": "0.2.2"

package/src/HttpRequest.d.ts

@@ -1,4 +1,5 @@
 import { AnyContextKey } from '@webpieces/core-util';
+import { RawRequest } from './RawRequest';
 /**
  * HttpRequest - webpieces' TRANSPORT-NEUTRAL inbound request.
  *
@@ -17,9 +18,25 @@ export declare class HttpRequest {
     readonly path: string;
     /** Header name (lowercased) -> values (HTTP allows multiple values per name). */
     readonly headers: Map<string, string[]>;
+    /**
+     * The verbatim bytes + absolute url, present ONLY on an `@Endpoint(..., { rawBody: true })`
+     * route (see {@link RawRequest}). Absent everywhere else, and absent is the SAFE state:
+     * `@AuthWebhook` has nothing to verify without it and 401s rather than waving the call
+     * through. A spec driving a webhook route in-process supplies one here, the same way a spec
+     * today supplies an `authorization` header.
+     */
+    readonly raw?: RawRequest | undefined;
     constructor(method: string, path: string, 
     /** Header name (lowercased) -> values (HTTP allows multiple values per name). */
-    headers: Map<string, string[]>);
+    headers: Map<string, string[]>, 
+    /**
+     * The verbatim bytes + absolute url, present ONLY on an `@Endpoint(..., { rawBody: true })`
+     * route (see {@link RawRequest}). Absent everywhere else, and absent is the SAFE state:
+     * `@AuthWebhook` has nothing to verify without it and 401s rather than waving the call
+     * through. A spec driving a webhook route in-process supplies one here, the same way a spec
+     * today supplies an `authorization` header.
+     */
+    raw?: RawRequest | undefined);
     /** First value of a header, looked up by ContextKey.httpHeader (or a raw lowercased name). */
     getHeader(key: AnyContextKey | string): string | undefined;
     /** All values of a header. */

package/src/HttpRequest.js

@@ -18,12 +18,22 @@ class HttpRequest {
     method;
     path;
     headers;
+    raw;
     constructor(method, path, 
     /** Header name (lowercased) -> values (HTTP allows multiple values per name). */
-    headers) {
+    headers, 
+    /**
+     * The verbatim bytes + absolute url, present ONLY on an `@Endpoint(..., { rawBody: true })`
+     * route (see {@link RawRequest}). Absent everywhere else, and absent is the SAFE state:
+     * `@AuthWebhook` has nothing to verify without it and 401s rather than waving the call
+     * through. A spec driving a webhook route in-process supplies one here, the same way a spec
+     * today supplies an `authorization` header.
+     */
+    raw) {
         this.method = method;
         this.path = path;
         this.headers = headers;
+        this.raw = raw;
     }
     /** First value of a header, looked up by ContextKey.httpHeader (or a raw lowercased name). */
     getHeader(key) {

package/src/HttpRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"HttpRequest.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/HttpRequest.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;GAYG;AACH,MAAa,WAAW;IAEA;IACA;IAEA;IAJpB,YACoB,MAAc,EACd,IAAY;IAC5B,iFAAiF;IACjE,OAA8B;QAH9B,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAuB;IAC/C,CAAC;IAEJ,8FAA8F;IAC9F,SAAS,CAAC,GAA2B;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAED,8BAA8B;IAC9B,eAAe,CAAC,GAA2B;QACvC,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACJ;AAnBD,kCAmBC","sourcesContent":["import { ContextKey, AnyContextKey } from '@webpieces/core-util';\n\n/**\n * HttpRequest - webpieces' TRANSPORT-NEUTRAL inbound request.\n *\n * This is @webpieces/http-routing's own request type (http-routing re-exports it), NOT\n * express's `req`. Each transport adapter (the express adapter in @webpieces/http-server, or\n * any other TypeScript web framework) builds an HttpRequest from its native request and hands\n * it to the router. Filters and the auth layer read it via `RequestContext.getRequest()`\n * instead of touching express — which is what lets the SAME filter chain run over HTTP and\n * in-process (tests build an HttpRequest carrying their credential).\n *\n * It lives in core-context (alongside RequestContext, which stores it in AsyncLocalStorage)\n * to avoid a core-context → http-routing cycle; it is a pure data holder (no express, no DI).\n */\nexport class HttpRequest {\n    constructor(\n        public readonly method: string,\n        public readonly path: string,\n        /** Header name (lowercased) -> values (HTTP allows multiple values per name). */\n        public readonly headers: Map<string, string[]>,\n    ) {}\n\n    /** First value of a header, looked up by ContextKey.httpHeader (or a raw lowercased name). */\n    getHeader(key: AnyContextKey | string): string | undefined {\n        const values = this.getHeaderValues(key);\n        return values && values.length > 0 ? values[0] : undefined;\n    }\n\n    /** All values of a header. */\n    getHeaderValues(key: AnyContextKey | string): string[] | undefined {\n        const name = (typeof key === 'string' ? key : key.httpHeader ?? key.name).toLowerCase();\n        return this.headers.get(name);\n    }\n}\n"]}
+{"version":3,"file":"HttpRequest.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/HttpRequest.ts"],"names":[],"mappings":";;;AAGA;;;;;;;;;;;;GAYG;AACH,MAAa,WAAW;IAEA;IACA;IAEA;IAQA;IAZpB,YACoB,MAAc,EACd,IAAY;IAC5B,iFAAiF;IACjE,OAA8B;IAC9C;;;;;;OAMG;IACa,GAAgB;QAXhB,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAuB;QAQ9B,QAAG,GAAH,GAAG,CAAa;IACjC,CAAC;IAEJ,8FAA8F;IAC9F,SAAS,CAAC,GAA2B;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC;IAED,8BAA8B;IAC9B,eAAe,CAAC,GAA2B;QACvC,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;CACJ;AA3BD,kCA2BC","sourcesContent":["import { ContextKey, AnyContextKey } from '@webpieces/core-util';\nimport { RawRequest } from './RawRequest';\n\n/**\n * HttpRequest - webpieces' TRANSPORT-NEUTRAL inbound request.\n *\n * This is @webpieces/http-routing's own request type (http-routing re-exports it), NOT\n * express's `req`. Each transport adapter (the express adapter in @webpieces/http-server, or\n * any other TypeScript web framework) builds an HttpRequest from its native request and hands\n * it to the router. Filters and the auth layer read it via `RequestContext.getRequest()`\n * instead of touching express — which is what lets the SAME filter chain run over HTTP and\n * in-process (tests build an HttpRequest carrying their credential).\n *\n * It lives in core-context (alongside RequestContext, which stores it in AsyncLocalStorage)\n * to avoid a core-context → http-routing cycle; it is a pure data holder (no express, no DI).\n */\nexport class HttpRequest {\n    constructor(\n        public readonly method: string,\n        public readonly path: string,\n        /** Header name (lowercased) -> values (HTTP allows multiple values per name). */\n        public readonly headers: Map<string, string[]>,\n        /**\n         * The verbatim bytes + absolute url, present ONLY on an `@Endpoint(..., { rawBody: true })`\n         * route (see {@link RawRequest}). Absent everywhere else, and absent is the SAFE state:\n         * `@AuthWebhook` has nothing to verify without it and 401s rather than waving the call\n         * through. A spec driving a webhook route in-process supplies one here, the same way a spec\n         * today supplies an `authorization` header.\n         */\n        public readonly raw?: RawRequest,\n    ) {}\n\n    /** First value of a header, looked up by ContextKey.httpHeader (or a raw lowercased name). */\n    getHeader(key: AnyContextKey | string): string | undefined {\n        const values = this.getHeaderValues(key);\n        return values && values.length > 0 ? values[0] : undefined;\n    }\n\n    /** All values of a header. */\n    getHeaderValues(key: AnyContextKey | string): string[] | undefined {\n        const name = (typeof key === 'string' ? key : key.httpHeader ?? key.name).toLowerCase();\n        return this.headers.get(name);\n    }\n}\n"]}

package/src/RawRequest.d.ts

@@ -0,0 +1,78 @@
+/**
+ * RawRequest - the parts of an inbound request a SIGNATURE is computed over, retained verbatim.
+ *
+ * It exists because every signed webhook (Sentry, GitHub, Stripe, Slack, Twilio) verifies a
+ * derivation over what the SENDER transmitted, and the ordinary request path destroys exactly that:
+ * the body is parsed into a DTO and the bytes are dropped. Re-stringifying the DTO is NOT a
+ * substitute — `JSON.stringify` of a parsed object differs from the wire bytes in non-ASCII escaping,
+ * number formatting (`1e3` vs `1000`) and duplicate-key resolution, so a check built on it passes
+ * every test and then 401s the first payload containing an emoji. Worse than no check.
+ *
+ * It is REQUEST-shaped rather than body-shaped on purpose. Twilio — the vendor this framework already
+ * built `formPost` for — signs the absolute URL plus the sorted POST params, not the raw body at all,
+ * so a seam that handed out only `rawBody` could not verify it.
+ *
+ * Retained ONLY for an `@Endpoint(..., { rawBody: true })` route, so the cost lands on webhook routes
+ * instead of on every request in the process.
+ *
+ * Per CLAUDE.md: data-only, therefore a class.
+ */
+export declare class RawRequest {
+    /**
+     * The ABSOLUTE url as the SENDER addressed it — scheme + host + path + query.
+     *
+     * Behind a TLS-terminating proxy (Cloud Run, any load balancer) express's own view is wrong
+     * in both halves: `req.protocol` reads `http` and the host is the internal one, while Twilio
+     * signs the public `https://...` url the customer configured. The express adapter therefore
+     * builds this from `x-forwarded-proto` / `x-forwarded-host` when present, falling back to
+     * `req.protocol` / the Host header. That is the ONE reconstruction rule; an app that fronts
+     * itself with something rewriting neither header gets a signature mismatch, so the rule is
+     * stated here rather than left for each app to guess at.
+     */
+    readonly absoluteUrl: string;
+    /**
+     * The exact transmitted bytes. A Buffer, not a string: some schemes sign bytes, and a string
+     * would bake in a UTF-8 decode that corrupts a non-UTF-8 body before the app ever sees it.
+     */
+    readonly rawBody: Buffer;
+    /** The peer address, when the transport knows it. Some vendors also publish IP ranges. */
+    readonly remoteAddr?: string | undefined;
+    /**
+     * Set when the body could NOT be parsed, instead of failing the request then and there.
+     *
+     * The failure is HELD so that AUTHENTICATION answers first. A malformed body from an
+     * unauthenticated caller must be a 401, not a 400 — a 400 says "your JSON was bad", which
+     * says "I got past auth", which is a free oracle on an endpoint whose url is public by
+     * construction. `AuthFilter` rethrows it as a 400 once, and only once, the caller is proven.
+     */
+    readonly bodyParseError?: Error | undefined;
+    constructor(
+    /**
+     * The ABSOLUTE url as the SENDER addressed it — scheme + host + path + query.
+     *
+     * Behind a TLS-terminating proxy (Cloud Run, any load balancer) express's own view is wrong
+     * in both halves: `req.protocol` reads `http` and the host is the internal one, while Twilio
+     * signs the public `https://...` url the customer configured. The express adapter therefore
+     * builds this from `x-forwarded-proto` / `x-forwarded-host` when present, falling back to
+     * `req.protocol` / the Host header. That is the ONE reconstruction rule; an app that fronts
+     * itself with something rewriting neither header gets a signature mismatch, so the rule is
+     * stated here rather than left for each app to guess at.
+     */
+    absoluteUrl: string, 
+    /**
+     * The exact transmitted bytes. A Buffer, not a string: some schemes sign bytes, and a string
+     * would bake in a UTF-8 decode that corrupts a non-UTF-8 body before the app ever sees it.
+     */
+    rawBody: Buffer, 
+    /** The peer address, when the transport knows it. Some vendors also publish IP ranges. */
+    remoteAddr?: string | undefined, 
+    /**
+     * Set when the body could NOT be parsed, instead of failing the request then and there.
+     *
+     * The failure is HELD so that AUTHENTICATION answers first. A malformed body from an
+     * unauthenticated caller must be a 401, not a 400 — a 400 says "your JSON was bad", which
+     * says "I got past auth", which is a free oracle on an endpoint whose url is public by
+     * construction. `AuthFilter` rethrows it as a 400 once, and only once, the caller is proven.
+     */
+    bodyParseError?: Error | undefined);
+}

package/src/RawRequest.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RawRequest = void 0;
+/**
+ * RawRequest - the parts of an inbound request a SIGNATURE is computed over, retained verbatim.
+ *
+ * It exists because every signed webhook (Sentry, GitHub, Stripe, Slack, Twilio) verifies a
+ * derivation over what the SENDER transmitted, and the ordinary request path destroys exactly that:
+ * the body is parsed into a DTO and the bytes are dropped. Re-stringifying the DTO is NOT a
+ * substitute — `JSON.stringify` of a parsed object differs from the wire bytes in non-ASCII escaping,
+ * number formatting (`1e3` vs `1000`) and duplicate-key resolution, so a check built on it passes
+ * every test and then 401s the first payload containing an emoji. Worse than no check.
+ *
+ * It is REQUEST-shaped rather than body-shaped on purpose. Twilio — the vendor this framework already
+ * built `formPost` for — signs the absolute URL plus the sorted POST params, not the raw body at all,
+ * so a seam that handed out only `rawBody` could not verify it.
+ *
+ * Retained ONLY for an `@Endpoint(..., { rawBody: true })` route, so the cost lands on webhook routes
+ * instead of on every request in the process.
+ *
+ * Per CLAUDE.md: data-only, therefore a class.
+ */
+class RawRequest {
+    absoluteUrl;
+    rawBody;
+    remoteAddr;
+    bodyParseError;
+    constructor(
+    /**
+     * The ABSOLUTE url as the SENDER addressed it — scheme + host + path + query.
+     *
+     * Behind a TLS-terminating proxy (Cloud Run, any load balancer) express's own view is wrong
+     * in both halves: `req.protocol` reads `http` and the host is the internal one, while Twilio
+     * signs the public `https://...` url the customer configured. The express adapter therefore
+     * builds this from `x-forwarded-proto` / `x-forwarded-host` when present, falling back to
+     * `req.protocol` / the Host header. That is the ONE reconstruction rule; an app that fronts
+     * itself with something rewriting neither header gets a signature mismatch, so the rule is
+     * stated here rather than left for each app to guess at.
+     */
+    absoluteUrl, 
+    /**
+     * The exact transmitted bytes. A Buffer, not a string: some schemes sign bytes, and a string
+     * would bake in a UTF-8 decode that corrupts a non-UTF-8 body before the app ever sees it.
+     */
+    rawBody, 
+    /** The peer address, when the transport knows it. Some vendors also publish IP ranges. */
+    remoteAddr, 
+    /**
+     * Set when the body could NOT be parsed, instead of failing the request then and there.
+     *
+     * The failure is HELD so that AUTHENTICATION answers first. A malformed body from an
+     * unauthenticated caller must be a 401, not a 400 — a 400 says "your JSON was bad", which
+     * says "I got past auth", which is a free oracle on an endpoint whose url is public by
+     * construction. `AuthFilter` rethrows it as a 400 once, and only once, the caller is proven.
+     */
+    bodyParseError) {
+        this.absoluteUrl = absoluteUrl;
+        this.rawBody = rawBody;
+        this.remoteAddr = remoteAddr;
+        this.bodyParseError = bodyParseError;
+    }
+}
+exports.RawRequest = RawRequest;
+//# sourceMappingURL=RawRequest.js.map

package/src/RawRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RawRequest.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/RawRequest.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAa,UAAU;IAaC;IAKA;IAEA;IASA;IA5BpB;IACI;;;;;;;;;;OAUG;IACa,WAAmB;IACnC;;;OAGG;IACa,OAAe;IAC/B,0FAA0F;IAC1E,UAAmB;IACnC;;;;;;;OAOG;IACa,cAAsB;QAhBtB,gBAAW,GAAX,WAAW,CAAQ;QAKnB,YAAO,GAAP,OAAO,CAAQ;QAEf,eAAU,GAAV,UAAU,CAAS;QASnB,mBAAc,GAAd,cAAc,CAAQ;IACvC,CAAC;CACP;AA/BD,gCA+BC","sourcesContent":["/**\n * RawRequest - the parts of an inbound request a SIGNATURE is computed over, retained verbatim.\n *\n * It exists because every signed webhook (Sentry, GitHub, Stripe, Slack, Twilio) verifies a\n * derivation over what the SENDER transmitted, and the ordinary request path destroys exactly that:\n * the body is parsed into a DTO and the bytes are dropped. Re-stringifying the DTO is NOT a\n * substitute — `JSON.stringify` of a parsed object differs from the wire bytes in non-ASCII escaping,\n * number formatting (`1e3` vs `1000`) and duplicate-key resolution, so a check built on it passes\n * every test and then 401s the first payload containing an emoji. Worse than no check.\n *\n * It is REQUEST-shaped rather than body-shaped on purpose. Twilio — the vendor this framework already\n * built `formPost` for — signs the absolute URL plus the sorted POST params, not the raw body at all,\n * so a seam that handed out only `rawBody` could not verify it.\n *\n * Retained ONLY for an `@Endpoint(..., { rawBody: true })` route, so the cost lands on webhook routes\n * instead of on every request in the process.\n *\n * Per CLAUDE.md: data-only, therefore a class.\n */\nexport class RawRequest {\n    constructor(\n        /**\n         * The ABSOLUTE url as the SENDER addressed it — scheme + host + path + query.\n         *\n         * Behind a TLS-terminating proxy (Cloud Run, any load balancer) express's own view is wrong\n         * in both halves: `req.protocol` reads `http` and the host is the internal one, while Twilio\n         * signs the public `https://...` url the customer configured. The express adapter therefore\n         * builds this from `x-forwarded-proto` / `x-forwarded-host` when present, falling back to\n         * `req.protocol` / the Host header. That is the ONE reconstruction rule; an app that fronts\n         * itself with something rewriting neither header gets a signature mismatch, so the rule is\n         * stated here rather than left for each app to guess at.\n         */\n        public readonly absoluteUrl: string,\n        /**\n         * The exact transmitted bytes. A Buffer, not a string: some schemes sign bytes, and a string\n         * would bake in a UTF-8 decode that corrupts a non-UTF-8 body before the app ever sees it.\n         */\n        public readonly rawBody: Buffer,\n        /** The peer address, when the transport knows it. Some vendors also publish IP ranges. */\n        public readonly remoteAddr?: string,\n        /**\n         * Set when the body could NOT be parsed, instead of failing the request then and there.\n         *\n         * The failure is HELD so that AUTHENTICATION answers first. A malformed body from an\n         * unauthenticated caller must be a 401, not a 400 — a 400 says \"your JSON was bad\", which\n         * says \"I got past auth\", which is a free oracle on an endpoint whose url is public by\n         * construction. `AuthFilter` rethrows it as a 400 once, and only once, the caller is proven.\n         */\n        public readonly bodyParseError?: Error,\n    ) {}\n}\n"]}

package/src/index.d.ts

@@ -3,6 +3,7 @@ export type { CapturedContext } from './CapturedContext';
 export type { RestorableContext } from './CapturedContext';
 export { RequestContextApiCallContext } from './RequestContextApiCallContext';
 export { HttpRequest } from './HttpRequest';
+export { RawRequest } from './RawRequest';
 export { provideSingletonDefaultForApi } from './provide';
 export { Provider } from './provide';
 export { provideFrameworkSingleton, provideFrameworkSingletonDefaultForApi, provideFrameworkTransient, bindFrameworkProvider, buildFrameworkModule, } from './frameworkProvide';

package/src/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PendingTrustedValue = exports.PendingWireTrust = exports.RequestContextReader = exports.RequestContextHeaders = exports.buildFrameworkModule = exports.bindFrameworkProvider = exports.provideFrameworkTransient = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.Provider = exports.provideSingletonDefaultForApi = exports.HttpRequest = exports.RequestContextApiCallContext = exports.RequestContext = void 0;
+exports.PendingTrustedValue = exports.PendingWireTrust = exports.RequestContextReader = exports.RequestContextHeaders = exports.buildFrameworkModule = exports.bindFrameworkProvider = exports.provideFrameworkTransient = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.Provider = exports.provideSingletonDefaultForApi = exports.RawRequest = exports.HttpRequest = exports.RequestContextApiCallContext = exports.RequestContext = void 0;
 // Context management with AsyncLocalStorage
 var RequestContext_1 = require("./RequestContext");
 Object.defineProperty(exports, "RequestContext", { enumerable: true, get: function () { return RequestContext_1.RequestContext; } });
@@ -12,6 +12,9 @@ Object.defineProperty(exports, "RequestContextApiCallContext", { enumerable: tru
 // Transport-neutral request stored in the context (http-routing's request type; re-exported there)
 var HttpRequest_1 = require("./HttpRequest");
 Object.defineProperty(exports, "HttpRequest", { enumerable: true, get: function () { return HttpRequest_1.HttpRequest; } });
+// The verbatim bytes + absolute url a webhook SIGNATURE is computed over ({ rawBody: true } routes).
+var RawRequest_1 = require("./RawRequest");
+Object.defineProperty(exports, "RawRequest", { enumerable: true, get: function () { return RawRequest_1.RawRequest; } });
 // DI provider decorators (shared DI seam; http-routing re-exports for back-compat)
 var provide_1 = require("./provide");
 Object.defineProperty(exports, "provideSingletonDefaultForApi", { enumerable: true, get: function () { return provide_1.provideSingletonDefaultForApi; } });

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/index.ts"],"names":[],"mappings":";;;AAAA,4CAA4C;AAC5C,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAiBvB,oGAAoG;AACpG,uGAAuG;AACvG,4FAA4F;AAC5F,+EAA8E;AAArE,4IAAA,4BAA4B,OAAA;AACrC,mGAAmG;AACnG,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,mFAAmF;AACnF,qCAA0D;AAAjD,wHAAA,6BAA6B,OAAA;AACtC,2FAA2F;AAC3F,qCAAqC;AAA5B,mGAAA,QAAQ,OAAA;AACjB,sFAAsF;AACtF,wEAAwE;AACxE,uDAM4B;AALxB,6HAAA,yBAAyB,OAAA;AACzB,0IAAA,sCAAsC,OAAA;AACtC,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,wHAAA,oBAAoB,OAAA;AAIxB,mFAAmF;AACnF,yFAAyF;AACzF,yBAAyB;AACzB,EAAE;AACF,8FAA8F;AAC9F,2FAA2F;AAC3F,uDAAuD;AACvD,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,oGAAoG;AACpG,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,uDAA2E;AAAlE,oHAAA,gBAAgB,OAAA;AAAE,uHAAA,mBAAmB,OAAA","sourcesContent":["// Context management with AsyncLocalStorage\nexport { RequestContext } from './RequestContext';\n// The OPAQUE snapshot type that copyContext() produces and restoreContext()/runWithContext() accept.\n//\n// `export type`, NOT `export` — deliberately. Consumers need to NAME it (a field, a queue entry, a\n// parameter) and nothing more. A VALUE export would hand them the class object, and with it the static\n// `capture(...)`, whose capability token a cast can supply even though this barrel never exports the\n// token's type: `CapturedContext.capture(null as never, new Map([['userId','victim']]))` would compile\n// and forge a proven identity — the exact hole this whole change closes. A type-only export removes the\n// class object from the package surface, so there is no factory to reach and copyContext() really is\n// the only producer. (ContextCaptureAuthority is not exported here in any form.)\nexport type { CapturedContext } from './CapturedContext';\n// The narrowed snapshot — what withTrusted() / withoutTrusted() produce and what\n// runWithContext()/restoreContext() accept. A bare CapturedContext is NOT accepted by either, so every\n// call site states whether the proven identity travels with the work (`grep -rn withTrusted`) or is\n// deliberately dropped (`grep -rn withoutTrusted`). Type-only for the same reason as above: with no\n// class object on the surface there is no `of(...)` factory to reach, cast or not.\nexport type { RestorableContext } from './CapturedContext';\n// SERVER impl of the core-util ApiCallContext seam, bound to RequestContext. Importing it here runs\n// its install() side effect, so LogApiCall (core-util, browser-safe) stamps the real RequestContext on\n// a Node server without importing it. A browser never loads core-context → keeps the no-op.\nexport { RequestContextApiCallContext } from './RequestContextApiCallContext';\n// Transport-neutral request stored in the context (http-routing's request type; re-exported there)\nexport { HttpRequest } from './HttpRequest';\n\n// DI provider decorators (shared DI seam; http-routing re-exports for back-compat)\nexport { provideSingletonDefaultForApi } from './provide';\n// Guice-style Provider<T> — lazy singleton OR fresh-per-get, decided by T's binding scope.\nexport { Provider } from './provide';\n// Framework-only DI registry (packages/** use these; keeps framework classes out of a\n// client's buildProviderModule() global scan). See frameworkProvide.ts.\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    provideFrameworkTransient,\n    bindFrameworkProvider,\n    buildFrameworkModule,\n} from './frameworkProvide';\nexport type { FrameworkScope } from './frameworkProvide';\n\n// Outbound headers for a SERVER: reads RequestContext directly, fails fast outside\n// RequestContext.run(...). Server-side clients (http-client-node, cloudtasks-client) and\n// http-routing use THIS.\n//\n// ContextMgr is deliberately NOT re-exported. It is the browser's answer (an app-held store),\n// and only @webpieces/http-client-browser may name it — importing it here would let a node\n// package reach for a ContextReader it has no use for.\nexport { RequestContextHeaders } from './RequestContextHeaders';\n// The browser store's server counterpart, still used by the logging packages + http-server filters.\nexport { RequestContextReader } from './RequestContextReader';\nexport { PendingWireTrust, PendingTrustedValue } from './PendingWireTrust';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-context/src/index.ts"],"names":[],"mappings":";;;AAAA,4CAA4C;AAC5C,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AAiBvB,oGAAoG;AACpG,uGAAuG;AACvG,4FAA4F;AAC5F,+EAA8E;AAArE,4IAAA,4BAA4B,OAAA;AACrC,mGAAmG;AACnG,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAEnB,mFAAmF;AACnF,qCAA0D;AAAjD,wHAAA,6BAA6B,OAAA;AACtC,2FAA2F;AAC3F,qCAAqC;AAA5B,mGAAA,QAAQ,OAAA;AACjB,sFAAsF;AACtF,wEAAwE;AACxE,uDAM4B;AALxB,6HAAA,yBAAyB,OAAA;AACzB,0IAAA,sCAAsC,OAAA;AACtC,6HAAA,yBAAyB,OAAA;AACzB,yHAAA,qBAAqB,OAAA;AACrB,wHAAA,oBAAoB,OAAA;AAIxB,mFAAmF;AACnF,yFAAyF;AACzF,yBAAyB;AACzB,EAAE;AACF,8FAA8F;AAC9F,2FAA2F;AAC3F,uDAAuD;AACvD,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,oGAAoG;AACpG,+DAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,uDAA2E;AAAlE,oHAAA,gBAAgB,OAAA;AAAE,uHAAA,mBAAmB,OAAA","sourcesContent":["// Context management with AsyncLocalStorage\nexport { RequestContext } from './RequestContext';\n// The OPAQUE snapshot type that copyContext() produces and restoreContext()/runWithContext() accept.\n//\n// `export type`, NOT `export` — deliberately. Consumers need to NAME it (a field, a queue entry, a\n// parameter) and nothing more. A VALUE export would hand them the class object, and with it the static\n// `capture(...)`, whose capability token a cast can supply even though this barrel never exports the\n// token's type: `CapturedContext.capture(null as never, new Map([['userId','victim']]))` would compile\n// and forge a proven identity — the exact hole this whole change closes. A type-only export removes the\n// class object from the package surface, so there is no factory to reach and copyContext() really is\n// the only producer. (ContextCaptureAuthority is not exported here in any form.)\nexport type { CapturedContext } from './CapturedContext';\n// The narrowed snapshot — what withTrusted() / withoutTrusted() produce and what\n// runWithContext()/restoreContext() accept. A bare CapturedContext is NOT accepted by either, so every\n// call site states whether the proven identity travels with the work (`grep -rn withTrusted`) or is\n// deliberately dropped (`grep -rn withoutTrusted`). Type-only for the same reason as above: with no\n// class object on the surface there is no `of(...)` factory to reach, cast or not.\nexport type { RestorableContext } from './CapturedContext';\n// SERVER impl of the core-util ApiCallContext seam, bound to RequestContext. Importing it here runs\n// its install() side effect, so LogApiCall (core-util, browser-safe) stamps the real RequestContext on\n// a Node server without importing it. A browser never loads core-context → keeps the no-op.\nexport { RequestContextApiCallContext } from './RequestContextApiCallContext';\n// Transport-neutral request stored in the context (http-routing's request type; re-exported there)\nexport { HttpRequest } from './HttpRequest';\n// The verbatim bytes + absolute url a webhook SIGNATURE is computed over ({ rawBody: true } routes).\nexport { RawRequest } from './RawRequest';\n\n// DI provider decorators (shared DI seam; http-routing re-exports for back-compat)\nexport { provideSingletonDefaultForApi } from './provide';\n// Guice-style Provider<T> — lazy singleton OR fresh-per-get, decided by T's binding scope.\nexport { Provider } from './provide';\n// Framework-only DI registry (packages/** use these; keeps framework classes out of a\n// client's buildProviderModule() global scan). See frameworkProvide.ts.\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    provideFrameworkTransient,\n    bindFrameworkProvider,\n    buildFrameworkModule,\n} from './frameworkProvide';\nexport type { FrameworkScope } from './frameworkProvide';\n\n// Outbound headers for a SERVER: reads RequestContext directly, fails fast outside\n// RequestContext.run(...). Server-side clients (http-client-node, cloudtasks-client) and\n// http-routing use THIS.\n//\n// ContextMgr is deliberately NOT re-exported. It is the browser's answer (an app-held store),\n// and only @webpieces/http-client-browser may name it — importing it here would let a node\n// package reach for a ContextReader it has no use for.\nexport { RequestContextHeaders } from './RequestContextHeaders';\n// The browser store's server counterpart, still used by the logging packages + http-server filters.\nexport { RequestContextReader } from './RequestContextReader';\nexport { PendingWireTrust, PendingTrustedValue } from './PendingWireTrust';\n"]}